CVSS: 9.3EPSS: 27%CPEs: 42EXPL: 2CVE-2007-6019 – Adobe Flash Player DeclareFunction2 Invalid Object Use Vulnerability
https://notcve.org/view.php?id=CVE-2007-6019
Adobe Flash Player 9.0.115.0 and earlier, and 8.0.39.0 and earlier, allows remote attackers to execute arbitrary code via an SWF file with a modified DeclareFunction2 Actionscript tag, which prevents an object from being instantiated properly. Adobe Flash Player 9.0.115.0 y versiones anteriores, y 8.0.39.0 y versiones anteriores, permite a atacantes remotos ejecutar código de su elección a través de un fichero SWF con una etiqueta modificada DeclareFunction2 Actionscript, lo cual evita que un objeto sea instanciado adecuadamente. This vulnerability allows remote attackers to execute code on vulnerable installations of Adobe's Flash Player. User interaction is required in that a user must visit a malicious web site. The specific flaw exists when the Flash player attempts to access embedded Actionscript objects that have not been properly instantiated. In order for exploitation to occur, an attacker would have to modify a DeclareFunction2 Actionscript tag within an SWF file. • https://www.exploit-db.com/exploits/31630 http://lists.apple.com/archives/security-announce/2008//May/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00006.html http://secunia.com/advisories/29763 http://secunia.com/advisories/29865 http://secunia.com/advisories/30430 http://secunia.com/advisories/30507 http://securityreason.com/securityalert/3805 http://sunsolve.sun.com/search/document.do?assetkey=1-26-238305-1 http://www.adobe.com/support/security • CWE-20: Improper Input Validation •
CVSS: 6.8EPSS: 9%CPEs: 3EXPL: 0CVE-2008-1201
https://notcve.org/view.php?id=CVE-2008-1201
Multiple unspecified vulnerabilities in FLA file parsing in Adobe Flash CS3 Professional, Flash Professional 8, and Flash Basic 8 on Windows allow user-assisted remote attackers to execute arbitrary code via a crafted .FLA file. Múltiples vulnerabilidades no especificadas en el análisis sintáctico FLA de Adobe Flash CS3 Professional, Flash Professional 8 y Flash Basic 8 en Windows permite a atacantes remotos ayudados por el usuario ejecutar código de su elección a través de un archivo .FLA manipulado. • http://ruder.cdut.net/blogview.asp?logID=241 http://secunia.com/advisories/29455 http://www.adobe.com/support/security/advisories/apsa08-03.html http://www.fortiguardcenter.com/advisory/FGA-2008-07.html http://www.securityfocus.com/bid/28349 http://www.securitytracker.com/id?1019681 http://www.vupen.com/english/advisories/2008/0948/references https://exchange.xforce.ibmcloud.com/vulnerabilities/41327 • CWE-94: Improper Control of Generation of Code ('Code Injection') •